0

We want a method to sanitize Cisco IOS 15 routers (ISR Gen 2) before they are removed from the facility. While a "write erase" works perfectly if the router is breathing, how to sanitize dead routers is the current issue.

I have been unable to find a method for encrypting the config file, but we can change the boot configuration to pull the config file from a compact flash card. Then, should the router die, we just remove the compact flash card and dispose of the router.

boot config flash0:startup-config

However, the router still appears to store the config file in the NVRAM, in addition to the compact flash.

CNS-RA1(config)#hostname TEST
TEST(config)#end
TEST#wr
Building configuration...
Compressed configuration from 27166 bytes to 11622 bytes[OK]
TEST#dir flash0:startup-config
Directory of flash0:/startup-config

   52  -rw-       37757   Apr 2 2020 12:20:12 -05:00  startup-config

256487424 bytes total (83161088 bytes free)
TEST#dir nvram:startup-config 
Directory of nvram:/startup-config

  239  -rw-       37757   Apr 2 2020 12:20:12 -05:00  startup-config

262136 bytes total (237453 bytes free)

Is there a way to stop the router from saving a copy of the configuration on the NVRAM?

How do others sanitize dead routers before removal?

Improve this question
5
  • What do you mean "dead router"? Not working, or simply not powered up?
    – Ron Trunk
    Apr 2, 2020 at 18:36
  • Instead of write memory (the default from your wr usage), have you tried doing the copy running-config flash0:/startup-config? This specifies the target for the copy command and so should not update NVRAM.
    – YLearn
    Apr 2, 2020 at 19:01
  • @RonTrunk, yes. Dead as won't power on.
    – Stephen Craven
    Apr 2, 2020 at 19:32
  • @YLearn, I tried your suggestion just now but I see the router time stamps on the NVRAM and FLASH0 files matching. I can only assume the router has made some kind of link between them.
    – Stephen Craven
    Apr 2, 2020 at 19:33
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 17, 2020 at 16:36

1 Answer 1

Reset to default
1

No matter what you do, there will always be "sensitive" data in NVRAM. That's what the NVRAM is for. If you must fully erase a system before disposal, removal of the NVRAM and/or RTC battery may be your only choice. Unfortunately, on many devices those things are not easily removable -- not socketed, not easily reachable, etc.

Ask Cisco TAC what their procedure is for DoD and other sensitive devices. (short of physical destruction... I recall Quantum's hard drive RMA calling for the serial number sticker and 1mm of the backing metal)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.